using-drawio-mcp
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill defines a specialized workflow for diagram generation and editing. No malicious patterns such as prompt injection, unauthorized data exfiltration, or obfuscation were identified.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data in the form of Draw.io XML and Mermaid source files (e.g., in
references/drawio-mcp-protocol.mdandSKILL.md). The workflow includes defensive measures such as XML escaping and rigorous structural verification (structural_QA) to ensure data integrity and prevent the interpretation of data as instructions. - [COMMAND_EXECUTION]: Interaction with the system is restricted to a specific set of tools (e.g.,
mcp__drawio__open_drawio_xml,mcp__drawio__list_pages) documented in the protocol file. These tools are scoped to diagram processing and do not provide a path for arbitrary shell command execution.
Audit Metadata